UV publish with index name does not read environment credentials

[sfriedowitz]

I was very excited to see the functionality with uv publish --index <index> come out in version 0.5.8 with this PR https://github.com/astral-sh/uv/pull/9694, but I don't think it behaves quite as I expected. It does not appear that publishing reads the UV_INDEX_MYINDEX_USERNAME and UV_INDEX_MYINDEX_PASSWORD for credentials when publishing.

Is this expected behavior? And if so, would it be possible to add support for reading credentials from those existing environment variables?

[charliermarsh]

I think it seems reasonable to pass the configuration to the publish URL. What do you think, @konstin @zanieb?

[zanieb]

Oh interesting. Do you expect the credentials for publishing to be the same as the ones for reading?

I'd expect them to be used, but I worry a different credential will be required?

[charliermarsh]

Is the implication that you might want a different environment variable?

[sfriedowitz]

At least for the private PyPI repository we run in my organization, the publishing and reading credentials are the same. So it seemed intuitive that the UV_INDEX_<NAME> variables would be used.

But perhaps the UV_INDEX variables could be used in the absence of the UV_PUBLISH variables?

[konstin]

We can add UV_INDEX_ as lowest priority credential source, behind CLI,UV_PUBLISH_ and (if used) the keyring.

[sfriedowitz]

We can add UV_INDEX_ as lowest priority credential source, behind CLI,UV_PUBLISH_ and (if used) the keyring.

That would be perfect, thank you !

[menzenski]

We publish Python libraries to a private Artifactory registry and use separate credentials for read-only operations and for publishing. Those are easy enough to map to the same environment variable names if needed but IMO it'd be nicer to be able to use different names when reading (installing dependencies) vs writing (publishing).

We can add UV_INDEX_ as lowest priority credential source, behind CLI,UV_PUBLISH_ and (if used) the keyring.

This option sounds great - this would let us use UV_PUBLISH_ for publishing operations and UV_INDEX_ for read-only operations - having the two "look" different is less confusing IMO.

[SalttownUser]

We publish to private GitLab projects with individual credentials for every project. In GitLab all the packages from one group are available accessing the group package registry(https://docs.gitlab.com/ee/user/packages/package_registry/#view-packages).

In this scenario the publish token for pushing the package to the project is not the same as the read token for getting the packages from the group registry. So in this case it would be nice, when UV_PUBLISH_ would be used to authenticate with publish-url and UV_INDEX_<name> would be used to authenticate with index <name> to read/check dependencies.

[konstin]

Reviewing our authentication system, i'm less inclined to do this: We currently fall back to prompting the user for username and password if there isn't any set. When index credentials and upload credentials are not the same (they usually should be different, since regular uv operations should have less privileges than publish), we would then instead of prompting use the wrong credentials from UV_INDEX_* and fail.

[erny]

I couldn't find any comment about using .netrc or .pypirc to store credentials for uv publish. Although I have both, uv doesn't use any of them.

[konstin]

uv does not read .netrc or .pypirc for publishing, we currently only support the keyring as persistent password storage.

[charliermarsh]

@konstin -- It seems like .netrc could make sense, what do you think?

[konstin]

Both files are standards that we can support (https://everything.curl.dev/usingcurl/netrc.html, https://packaging.python.org/en/latest/specifications/pypirc/), and we already support netrc for index authenticaton (i.e. we only have to wire this to publish, too), with the caveat that I'd generally nudge people towards the system keyring as a safer alternative to storing password in a plain text file.

[BartekSzpak]

I went through this page in the documentation and got surprised that setting the UV_PUBLISH_USERNAME and UV_PUBLISH_PASSWORD allowed me to publish to a private repository (nexus and not the codeartifact) without being prompted for credentials.

Not sure if this is intentional, but very useful from my perspective.

[dzanaga]

in case a user wants to publish to different indexes, would it be possible to have different UV_PUBLISH_ env vars? similarly to UV_INDEX_INDEXNAME_USERNAME, could we have UV_PUBLISH_INDEXNAME_USERNAME/PASSWORD

or what would be the preferred way to automate publishing to different indexes?

[konstin]

I'd recommend running the two uv publish commands with different UV_PUBLISH_ values. If you're publishing from a local machine, you can also use the keyring support for dispatching.

[rainermensing]

A closely related issue to this that I could consider part of it: Can we add the --env-file flag to uv publish? To be fair, it is not available for uv sync either (only uv run), but since sync runs in the background of uv run, you can already use a .env file to set index credentials. Maybe this needs a new issue?

EDIT: would there be anything problematic with this workaround? It does not seem to install uv again... uvx --env-file .env uv publish